| शीर्षक | wooey Wooey 0.13.3-dev Code Injection |
|---|
| विवरण | A vulnerability was found in wooey Wooey (master branch, post v0.13.2). The add_or_update_script API endpoint (/api/scripts/v1/add-or-update/) in wooey/api/scripts.py only checks if a user is authenticated but does not verify staff/admin privileges. This allows any registered user to upload arbitrary Python scripts via the API, which are then executed by Celery workers, leading to Remote Code Execution (RCE). The attack can be initiated remotely and does not require special privileges beyond a registered account. |
|---|
| स्रोत | ⚠️ https://github.com/wooey/Wooey/issues/408 |
|---|
| उपयोगकर्ता | anch0r (UID 96691) |
|---|
| सबमिशन | 10/04/2026 03:52 AM (6 महीनों पहले) |
|---|
| संयम | 26/04/2026 09:43 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359741 [Wooey तक 0.13.2 API Endpoint wooey/api/scripts.py add_or_update_script अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|